Don't keep extra id_token info in token_response.

This tweaks `Flow.step2_exchange` to only preserve the raw `id_token` response
in the generated `Credentials`, and updates `CHANGELOG`.